无法从Integration Studio部署集成服务到WSO2 APIM服务目录

开发者阿泽

2026-8-26

问题描述

我在嵌入式MI的toml配置文件中添加了如下配置：

[[service_catalog]]
apim_host = "https://localhost:9443"
enable = true
username = "xxxxxxxx"
password = "xxxxxxxx"

确认metadata和swagger文件均已存在后，点击Export Project Artifacts and Run，但未找到官方文档中提及的Publish to Service Catalog复选框。

首次尝试操作时出现如下错误（日志表明程序尝试执行发布操作）：

ERROR {ServiceCatalogUtils} - Error occurred while reading the response from service catalog javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: signature check failed
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:198)
    at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1967)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:331)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:325)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1688)
    at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:226)
    at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1082)
    at sun.security.ssl.Handshaker.process_record(Handshaker.java:1010)
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1079)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1388)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1416)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1400)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1570)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1498)
    at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:480)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:352)
    at org.wso2.micro.integrator.initializer.utils.ServiceCatalogUtils.getAllServices(ServiceCatalogUtils.java:209)
    at org.wso2.micro.integrator.initializer.serviceCatalog.ServiceCatalogExecutor.run(ServiceCatalogExecutor.java:59)
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
    at java.util.concurrent.FutureTask.run(FutureTask.java:266)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at java.lang.Thread.run(Thread.java:748)
Caused by: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: signature check failed
    at sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:380)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:285)
    at sun.security.validator.Validator.validate(Validator.java:262)
    at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:330)
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:237)
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:132)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1670)
    ... 20 more
Caused by: java.security.cert.CertPathValidatorException: signature check failed
    at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:135)
    at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:233)
    at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:141)
    at sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:80)
    at java.security.cert.CertPathValidator.validate(CertPathValidator.java:292)
    at sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:375)
    ... 26 more
Caused by: java.security.SignatureException: Signature does not match.
    at sun.security.x509.X509CertImpl.verify(X509CertImpl.java:457)
    at sun.security.provider.certpath.BasicChecker.verifySignature(BasicChecker.java:166)
    at sun.security.provider.certpath.BasicChecker.check(BasicChecker.java:147)
    at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:125)
    ... 31 more

随后我将APIM证书导入嵌入式MI的信任库，上述SSL错误已消失，但未出现Successfully updated the service catalog的成功提示，进入APIM的Services标签页查看也未找到已发布的服务，请问是否遗漏了配置步骤，或是存在操作错误？

排查方案

按以下顺序逐一核对定位问题：

版本匹配校验：嵌入式MI 4.1.0及以上版本才支持Service Catalog自动发布能力，低于该版本的工具链不会显示Publish to Service Catalog复选框，也不会执行自动发布逻辑。
账号权限校验：toml中配置的APIM账号，必须拥有Service Catalog接口的读写权限，优先使用admin账号做连通性测试，排除权限拦截问题。
元数据文件校验：每个待发布服务对应的Metadata.yaml文件，必须存放在CAR包的META-INF目录下，文件中serviceKey字段需全局唯一，不能与APIM侧已存在的服务重名；文件格式不符合规范时发布流程会直接跳过，不会抛出显性错误。
信任库路径校验：嵌入式MI默认加载的信任库路径为<MI_HOME>/repository/resources/security/client-truststore.jks，默认密钥为wso2carbon，若证书导入到了其他信任库文件，MI不会加载，会出现SSL错误消失但请求实际失败的情况。
开启调试日志定位静默错误：修改MI的log4j2.properties配置文件，添加如下配置：
```
logger.service-catalog.name = org.wso2.micro.integrator.initializer.serviceCatalog
logger.service-catalog.level = DEBUG
```
重启MI后重新部署CAR包，即可从日志中看到发布流程的具体执行节点，定位是元数据解析失败、接口鉴权失败还是服务定义校验不通过。
接口连通性直连校验：使用curl或接口调试工具直接调用https://<apim_host>:9443/api/am/service-catalog/v0/services接口，使用配置的账号做基础鉴权，确认接口返回200状态码，排除APIM侧Service Catalog组件未正常启动的问题。

高频静默失败原因：导入证书时未导入完整证书链，仅导入APIM叶子证书未导入根证书，SSL握手阶段不报错但实际HTTPS请求会被重置；或metadata文件中服务版本、协议字段不符合APIM校验规则，发布请求被APIM侧拦截但MI侧未打印错误日志。

内容的提问来源于stack exchange，提问作者viggnah